FDA offers its first assessment of what happened in Yuma, Arizona.

The Food and Drug Administration (FDA) on Thursday offered its first thorough postmortem of the recent E. coli outbreak linked to romaine lettuce. We last heard from the agency on this topic in June, when it announced that canal water in Yuma County, Arizona—the winter lettuce capital of the world—contained the same strain of E. coli found to be sickening people, and noted that the investigation was ongoing. Thursday’s release helps illustrate the full scale of the outbreak, provides new clues about what went wrong, and suggests the incident may permanently alter the federal government’s relationship to bagged salad.

To start, FDA’s “environmental assessment” provides the most recent update of the outbreak’s massive scale. Sickening 210 people across 36 states, sending nearly 100 to the hospital, and killing five, it was the largest outbreak of E. coli 0157:H7 in this country since 2006. Those numbers—including the five deaths—are similar to what was already known in June, so the human toll of the outbreak hasn’t turned out to be much larger than we knew. What is new, though, is a sense of how many farms were involved.

Until now, it hasn’t been known whether the outbreak was linked to just one producer, or if there was some kind of more systemic problem. Thursday’s report paints a clearer picture. An investigation by FDA and the Centers for Disease Control (CDC) found that 36 fields on 23 different Yuma County farms supplied lettuce that was potentially contaminated with the rare strain of E. coli implicated in the outbreak. The culprit? A 3.5-mile-long irrigation canal near Wellton, Arizona, which the farms each relied on for water.

The agencies don’t know exactly how the water became contaminated in the first place, though they note it had an animal, not human, source—likely some form of domesticated livestock or wildlife. But all those plots relied on the affected water at some point. The FDA says that the most plausible ways the water reached the crops were through direct application, or when it was used to dilute pesticides sprayed on the fields. It also notes that a late season freeze—in early February—may have weakened the plants and made them more susceptible to contamination.

A compounding factor, though—and one reason why such a huge volume of lettuce was potentially impacted—was the way local processing plants mixed together romaine from multiple producers, complicating the investigation and potentially cross-contaminating product. Though the agencies only found the E. coli in question on a single farm, the 36 fields affected shared infrastructure, greatly muddying the picture.

“The commingling of romaine lettuce from various farm growing fields at fresh-cut produce manufacturing/processing facilities complicated traceback efforts and made it impossible for FDA to definitively determine which farm or farms identified in the traceback supplied romaine lettuce contaminated with the E. coli O157:H7 outbreak strain,” said the report.

It’s that scenario that the agencies will work harder to prevent. Though FDA and CDC found no specific “deficiencies” at packing plants in the area, they signaled that they are exploring actions that would prevent a similar outbreak in the future.

“Going forward, both FDA and industry need to explore better ways to standardize record keeping and determine whether the use of additional tools on product packaging could improve traceability,” FDA Commissioner Scott Gottlieb wrote, in a statement.

That will likely include more aggressive safety testing on the ground. “The FDA plans to collect and analyze romaine lettuce samples through a new special surveillance sampling assignment for contamination with human pathogens,” Gottlieb wrote. “This will help us determine whether products are safe to enter the U.S. marketplace.” As of now, it’s unclear exactly what kind of system would be put into place, though the Commissioner suggested whole-genome sequencing could be an option back in June.

For now, Gottlieb wrote, more action is needed “on all fronts”—the private and public sector will need to work harder, and work together, if they are to prevent another Yuma.